Fly-by-wire flight control system and method

ABSTRACT

A multi-axis serially redundant, single channel, multi-path fly-by-wire control system comprising: serially redundant flight control computers in a single channel where only one “primary” flight control computer is active and controlling at any given time; a matrix of parallel flight control surface controllers including stabilizer motor control units (SMCU) and actuator electronics control modules (AECM) define multiple control paths within the single channel, each implemented with dissimilar hardware and which each control the movement of a distributed set of flight control surfaces on the aircraft in response to flight control surface commands of the primary flight control computer; and a set of (pilot and co-pilot) controls and aircraft surface/reference/navigation sensors and systems which provide input to a primary flight control computer and are used to generate the flight control surface commands to control the aircraft in flight in accordance with the control law algorithms implemented in the flight control computers.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/324,831, filed on Jul. 7, 2014 which is a continuation of U.S. patentapplication Ser. No. 13/743,076, filed on Jan. 16, 2013, which hasmatured into U.S. Pat. No. 8,818,575 and which is a continuation of U.S.patent application Ser. No. 12/594,533, filed on Aug. 11, 2010, whichhas matured into U.S. Pat. No. 8,386,093 and which is the National Stageof International Patent Application No. PCT/GB2008/050216, filed on Mar.26, 2008, which claims priority to U.S. Provisional Application60/921,955, filed on Apr. 5, 2007. The contents of all five applicationsare hereby incorporated by reference in their entirety.

FIELD OF THE INVENTION

The present invention generally relates to aircraft control systems and,in particular, to a multi-axis serially redundant, single channel,multi-path fly-by-wire flight control system.

BACKGROUND OF THE INVENTION

Fly-by-wire technology has provided a major advance in aircraft flightcontrol systems.

Mechanical flight control systems had been prevalent where the flightcontrol surfaces on an aircraft were controlled using a system ofcables, linkages and mechanical controls as the primary and usually onlycontrol paths. Only limited, basic mechanical failure mode contingencywas possible in such systems.

With the advent of electronics and computer-aided flight controls,mechanical systems were given enhanced controllability throughaugmentation with, e.g., electrical drive assist and controls.

Such improvements allowed for the development of advanced control lawsthat, among other things, improve and increase aircraft controllabilityand performance. These control laws can be complex and theirimplementation in a mechanical control system, even those withelectronic assistance, is difficult and often results in significantincrease in aircraft weight.

As the next step in relevant technological evolution, mechanicallinkages (rods, cables, arms, etc) were replaced by motors, actuatorsand drives with associated wiring as so-called “fly-by-wire”technologies were developed.

A simplified diagram of a known fly-by-wire (FBW) system is shown inFIG. 1. In such a fly-by-wire system, there is no direct mechanicalcoupling between the pilot controls 10 and a flight control surface 20.Known fly-by-wire systems include for example, a set of pilot controls10 which provide electrical signals to aircraft electronics 24, wherethey are combined with other airplane data to produce flight controlsurface commands. Instead of mechanical linkages and their attendantdisplacement/translation, the commands are transmitted across wires 38to electrically control the movement of actuator/motors 26 that move theflight control surfaces 20.

For purposes of safety, fly-by-wire systems typically include redundantcomponents so that if one component of the system fails, the aircraftcan still be safely controlled. In such prior art systems, it is knownto provide redundancy on an axis-by-axis basis. For example as shown inFIG. 2, some prior art fly-by-wire architectures have separate systemsthat control the movement of the aircraft in each of the roll, pitch andyaw axes.

In these prior art systems, each axis control system typically includeda dedicated primary flight computer/processor and a back-up flightcomputer/processor that control movement of the aircraft in a particularaxis. If the primary flight computer/processor that controls one axiswere also to fail, the back-up computer/processor would engage tocontrol that axis of the aircraft. Similarly, the other axis systemswould each include a primary and back-up flight computer/processor.However, if the back-up computer/processor in a particular axis channelwere to fail, the computers/processors in the other axis channels couldnot function to fly the aircraft in the failed axis.

As an improvement to such systems, redundant multi-channel, multi-axes,fly-by-wire control systems such as shown in FIG. 3 were introduced, inwhich the fly-by-wire system is divided into a series of parallelindependent control channels, each channel capable of flying theaircraft. Each control channel is substantially isolated from the othercontrol channels such that the channels operate in parallel and provideredundancy where in the event of a malfunction in or of one channel, thecontinued operation of the remaining channels is not affected andmulti-axis controllability is maintained.

With reference to FIGS. 3 and 4, one such prior art fly-by-wire systemincludes three isolated identical control channels—a left flight controlchannel 60, a center flight control channel 80 and a right flightcontrol channel 90—each channel having its own dedicated primary flightcomputer 64, 84 or 94 and actuator control electronics unit (ACE) 62, 82or 92, the ACE controlling a set of associated flight control surfaces66. Each flight control channel is fully redundant and can control allaxes of the aircraft.

As shown in FIG. 4, pilot/co-pilot control inputs (via respectivetransducer signals) are provided to each of ACEs 62, 82, and 92 whichthen make available the transducer signal over its designated one ofthree data buses 40, 42, and 44. The primary flight computers 64, 84,and 94 each receives transducer signals from each of the three databuses 40, 42, and 44. Each of the primary flight computers (left 64,center 84 and right 94) selects one of the transducer signals receivedfrom one of the three ACEs to use in generating a set of flight surfacecommands, which particular transducer signal is selected by the flightcomputers is based on predetermined selection rules. After selecting atransducer signal from one of the three ACEs, left primary flightcomputer 64 generates a set of proposed flight surface commands whichare then transmitted over the data bus 40, while the center and rightprimary flight computers 84 and 94 transmit their sets of proposedflight surface commands on the center and right data buses 42, and 44,respectively. The left primary flight computer 64 compares the set ofproposed flight surface commands it has generated with the proposedflight surface commands generated by each of the other primary flightcomputers 84 and 94. In a mid-value select block 379 a, the left primaryflight computer 64 selects the middle value of each of the flightsurface commands. The left primary flight computer 64 then transmits theselected middle values of the flight surface commands over the left databus 40, while the center and right primary flight computers transmittheir selected middle value flight surface commands on the center andright data buses 42 and 44. The ACEs 62, 82 and 92 receive therespective sets of flight surface commands generated by each of theprimary flight computers 64, 84, and 94. The left ACE 62 selects one ofthe sets of flight surface commands generated by one of the threeprimary flight computers in accordance with the signal select functionof an input signal management block where the ACE selects the commandsfrom the flight control computer in its own channel. Once the ACE 62 hasselected a set of flight surface commands, it applies the selected setof flight surface commands to a servo loop, which controls an actuator558 a that moves the appropriate aircraft control surface. The operationof the center primary flight computer 84 and the right primary flightcomputer 94 are the same as that of the left primary flight computer 64described.

In this fashion, this prior art fly-by-wire control system demonstratesa plurality of independent and isolated flight control channels eachchannel including an actuator controller electronics unit (ACE) thatreceives transducer signals that are indicative of the position of thepilot controls and a primary flight computer that is coupled to that ACEand which generates flight surface commands based on the transducersignals received from the ACE. The ACE in each isolated flight controlchannel receives the flight surface commands from the correspondingprimary flight computer and sends the commands to a plurality of servoloops that control the movement of a set of flight control surfaces onthe aircraft.

In this known system, each of the plurality of flight control channelsis an independent, isolated, control channel, each of the plurality offlight control channels is of identical configuration, and all of theplurality of channels operate in parallel, with redundancy incorporatedthrough the parallel operation.

The set of flight control surfaces controlled by each isolated flightcontrol channel is selected so that operation of a single isolatedflight control channel is sufficient to fly the aircraft in the eventthat the remaining isolated flight control channels fail, furthercharacterizing the independent, isolated and redundant nature andaforementioned structure of this known flight control channel.

The foregoing is believed to describe the prior art systems as setforth, for example, in U.S. Pat. No. 5,493,497.

Such parallel structure requires that all independent channels areactive in normal mode function and operate in a synchronized (e.g.,real-time) fashion. Failure mode monitoring requires flight controlcommands to be constantly compared between the simultaneously operatingredundant control channels. In the failure operation of these types ofsystems, if one primary flight computer fails, the remaining onescontinue to operate all channels under a failure management scheme andcontrol the aircraft.

While the above prior art fly-by-wire system provides redundant controlchannels such that the aircraft can be controlled safely by one channelin case of failures of other channels, one drawback of the prior art isthat a generic fault at the ACE level (e.g., batch failure—manufacturingdefects) could affect all ACEs, which could degrade the controllabilityof all surfaces. Another drawback is the need for duplicative componentsto achieve functional operation of such prior art redundant system.

SUMMARY OF THE INVENTION

The present invention provides advancements in the state of the relevantart by, inter alia, providing a multi-axis serially redundant, singlechannel, multi-path, generic fault tolerant fly-by-wire aircraft controlsystem in which internal architectural dissimilarities are provided forall critical flight control electronics such that the aircraft can becontrolled safely in case of multiple control electronics failures andthe system is also fault tolerant to a generic fault ofcomputer/processor, or a generic fault of other complex hardware.

In accordance with an embodiment, the present technology provides afly-by-wire flight control system of an aircraft, the system comprising:

-   -   a plurality of input controls, each one of the plurality of        input controls being capable of generating a signal indicative        of a commanded position of at least one flight control surface;    -   a plurality of flight control computers, each one of the        plurality of flight control computers being capable of        generating flight surface control commands according to        predetermined flight control algorithms in part as a function of        the signal, wherein at least one of the plurality of flight        control computers is capable of determining that it is invalid        based on a self-testing regime; and    -   a plurality of flight control surface controllers, each one of        the plurality of flight control surface controllers being        capable of controlling the at least one flight control surface        based on at least one of (i) the flight surface control commands        generated by at least one of the plurality of flight control        computers and (ii) the signal.

In another aspect, at least another one of the plurality of flightcontrol computers is capable of becoming an active primary flightcontrol computer upon determination by the at least one of the pluralityof flight control computers that it is invalid.

In yet another aspect, at least one of the plurality of flight controlsurface controllers, upon determining that none of the plurality offlight control computers is capable of becoming an active primary flightcontrol computer, is capable of being commanded according topredetermined flight control algorithms for direct mode operation inresponse to the signal.

In another aspect, the at least one of the plurality of flight controlcomputers comprises a command lane and a monitor lane capable ofcomparing against one another.

In yet another aspect, the self-testing is configured so that adiscrepancy outside a predetermined tolerance between the command laneand the monitor lane results in the at least one of the plurality offlight control computers setting its status as invalid.

In another aspect, the self-testing is configured so that a discrepancyoutside a predetermined tolerance between the command lane and themonitor lane results in the at least one of the plurality of flightcontrol computers taking itself offline.

In yet another aspect, at least one of the plurality of flight controlsurface controllers is being indicated that the status of the at leastone of the plurality of flight control computers is invalid.

In another aspect, the command lane and the monitor lane have dissimilarprocessors.

In yet another aspect, the at least another one of the plurality offlight control computers is capable of becoming the active primaryflight control computer based on (i) a determination by the at least oneof the plurality of flight control computers that it is invalid and (ii)a priority logic.

In another aspect, a validity block configured to detect whether novalid flight control computer amongst the plurality of flight controlcomputers is available and further configured to instruct a switchingblock to disconnect flight surface control commands and to connectdirect mode control.

In accordance with another embodiment, the present technology provides aflight control computer for an aircraft, the flight control computercomprising:

-   -   a receiving module for receiving a signal indicative of a        commanded position of at least one flight control surface of the        aircraft, the signal being generated by at least one input        control;    -   a first processor configured to execute a command lane, the        command lane generating flight surface control commands        according to predetermined flight control algorithms in part as        a function of the signal;    -   a second processor configured to execute a monitor lane; and    -   a self-testing module configured to compare the command lane        against the monitor lane to identify whether the flight control        computer is to operate at least one of (i) taking itself offline        and (ii) setting its status as invalid.

In another aspect, the self-testing module is configured so as todetermine whether a difference between the command lane and the monitorlane is within a predetermined tolerance.

In yet another aspect, the flight control computer further comprises amodule configured to determine that the flight control computer is tobecome an active primary flight control computer upon determination thatanother flight control computer is invalid.

In accordance with another embodiment, the present technology provides aflight surface controller for an aircraft, the flight surface controllercomprising:

-   -   a receiving module for receiving at least one of flight surface        control commands and a signal, the flight surface control        commands being generated by a flight control computer and the        signal being generated by an input control;    -   a control module being capable of controlling at least one        flight control surface of the aircraft based on at least one of        the flight surface control commands and the signal; and    -   a command decode logic module capable of determining that no        flight control computer is being capable of becoming an active        primary flight control computer of the aircraft.

In another aspect, the control module is capable of being commandedaccording to predetermined flight control algorithms for direct modeoperation in response to the signal upon determination, by the commanddecode logic module, that no flight control computer is being capable ofbecoming an active primary flight control computer of the aircraft.

In accordance with another embodiment, the present technology provides amethod of controlling an aircraft, the method comprising:

-   -   receiving a signal indicative of a commanded position of at        least one flight control surface of the aircraft;    -   generating, by a first flight control computer, flight surface        control commands according to predetermined flight control        algorithms in part as a function of the signal;    -   upon determining that the first flight control computer is        invalid, selecting a second flight control computer to become an        active primary flight control computer;    -   generating, by the second flight control computer, flight        surface control commands according to predetermined flight        control algorithms in part as a function of the signal; and    -   applying the flight surface control commands to a flight control        surface controller, the flight control surface controller being        capable of controlling at least one flight control surface of        the aircraft.

In another aspect, the method further comprises:

-   -   determining that none of the first flight control computer and        the second flight control computer is capable of becoming the        active primary flight control computer; and    -   commanding the flight control surface controller according to        predetermined flight control algorithms for direct mode        operation in response to the signal.

In yet another aspect, determining that the first flight controlcomputer is invalid is executed by a self-testing module of the firstflight control computer.

In another aspect, the method comprises, upon determining that the firstflight control computer is invalid, at least one of (i) taking the firstflight control computer offline and (ii) setting the status of the firstflight control computer as invalid.

In accordance with another embodiment, the present technology provides afly-by-wire flight control system of an aircraft, comprising:

-   -   a plurality of input controls, each one of the plurality of        input controls being capable of generating a signal indicative        of a commanded position of at least one flight control surface;    -   a plurality of flight control computers, wherein a first one of        the plurality of flight control computers is an active flight        control computer capable of generating flight surface control        commands according to predetermined flight control algorithms in        part as a function of the signal; and    -   wherein the first one of the plurality of flight control        computers is capable of determining that it is invalid, and a        second one of the plurality of flight control computers is        capable of becoming the active flight control computer.

In another aspect, each one of the plurality of flight control surfacecontrollers receives flight control commands from each one of theplurality of flight control computers.

In yet another aspect, at least one of the plurality of flight controlsurface controllers comprises a command decode logic block forwardingonly flight control commands from one of the plurality of flight controlcomputers determined as being the primary flight control computer.

In another aspect, only one of the plurality of flight control computersdetermined as being the primary flight control computer transmits theflight control commands onto a databus connecting the plurality offlight control computers to the plurality of flight control surfacecontrollers.

In yet another aspect, at least one of the plurality of flight controlcomputers is capable of at least one of (i) providing full controlfunctionality in all aircraft axes, (ii) operating independently in anactive/standby configuration and (iii) operating with no output commandvoting/comparison between at least two of the plurality of flightcontrol computers.

In another aspect, each one of the plurality of flight control computersis capable of operating independently in a passive standby mode toserially come on-line as a primary flight control computer in an eventof failure of one of the plurality of flight control computerspreviously determined to be the active primary flight control computer.

In yet another aspect, the system further comprises:

-   -   a plurality of control paths, each one of the plurality of        control paths controlling a different subset of a set of flight        control surfaces, the flight control surfaces comprising the at        least one flight control surface;    -   at least one of the plurality of control paths comprising a        first flight control surface controller selected amongst the        plurality of flight control surface controllers, the first        flight control surface controller controlling such a subset of        flight control surfaces to adjust an attitude of the aircraft in        at least one of a roll axis, a pitch axis and a yaw axis; and    -   at least another one of the plurality of control paths        comprising a second flight control surface controller selected        amongst the plurality of flight control surface controllers, the        second flight control surface controller controlling such a        subset of flight control surfaces to control an horizontal        stabilizer trim, such that comprehensive control of the aircraft        is achieved by an actuator control module in combination with a        servo motor control unit.

In accordance with another embodiment, the present technology provides afly-by-wire flight control system of an aircraft, the system comprising:

-   -   a plurality of input controls, each one of the plurality of        input controls being capable of generating a signal indicative        of a commanded position of at least one flight control surface;    -   a plurality of flight control computers, each one of the        plurality of flight control computers being capable of        generating flight surface control commands according to        predetermined flight control algorithms in part as a function of        the signal, wherein at least one of the plurality of flight        control computers is capable of becoming an active primary        flight control computer upon determination that another one of        the plurality of flight control computers is invalid; and    -   a plurality of flight control surface controllers, each one of        the plurality of flight control surface controllers being        capable of controlling the at least one flight control surface        based on at least one of the flight surface control commands        generated by at least one of the plurality of flight control        computers and the signal, wherein at least one of the plurality        of flight control surface controllers, upon determining that        none of the plurality of flight control computers being capable        of becoming an active primary flight control computer, is        capable of being commanded according to predetermined flight        control algorithms for direct mode operation in response to the        signal.

In another aspect, determining that the first flight control computer isinvalid is based on a comparison of a command lane and a monitor lane ofthe first flight control computer.

It will be appreciated by those skilled in the art that the foregoingbrief description and the following detailed description are exemplaryand explanatory of this invention, and are not intended to berestrictive thereof or limiting of the advantages which can be achievedby this invention. Thus, the accompanying drawings, referred to hereinand constituting a part hereof, illustrate preferred embodiments of thisinvention, and, together with the detailed description, serve to explainthe principles of this invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Additional aspects, features, and advantages of the invention, both asto its structure and operation, will be understood and will become morereadily apparent when the invention is considered in the light of thefollowing description of illustrative embodiments made in conjunctionwith the accompanying drawings, wherein:

FIG. 1 is a general representation of a prior art fly-by-wire aircraftflight control system;

FIG. 2 is a simplified schematic diagram of a prior art fly-by-wirecontrol system capable of controlling only one aircraft axis;

FIG. 3 is a block diagram of a known multi-channel, parallel redundantfly-by-wire control system;

FIG. 4 is an operational diagram illustrating the multi-channel,cross-channel interactive, parallel operation of the fly-by-wire controlsystem of FIG. 3;

FIG. 5 is a block diagram of a serially redundant multi-axis fly-by-wirecontrol system according to an illustrative embodiment of the presentinvention;

FIG. 6 is a detailed diagram of a portion of the FBW system of FIG. 5;

FIG. 7 is an illustrative block diagram showing an AECM of FIG. 6;

FIG. 8 is a detailed illustrative diagram of the AECM3D of FIG. 7; and

FIG. 9(A-E) is a diagram showing the distributed control surfaces of theAECMs and SMCUs illustrated in FIG. 6.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

The flight control system of the present invention is a fly-by-wiremulti-axis flight control system that is fault-isolated, fault tolerant,fail-safe and fail-operational. Its architecture and operational detailswill be discussed in detail below in the context of an illustrativeembodiment and with reference to the figures provided.

General Overview

The illustrative embodiment of the multi-axis serially redundant, singlechannel, multi-path fly-by-wire flight control system (FCS) of thepresent invention includes a single control channel architecture basedon serially redundant flight computers and comprising within the channela plurality of control paths each with its own dissimilar hardwareflight control surface controllers, which paths together, in the singlechannel, provide manual and automatic control of the aircraft in each ofthe pitch, roll and yaw axes through a matrix of complementarydistributed control surfaces responsive to commands generated by theflight computers in accordance with predetermined control lawalgorithms.

The fly-by-wire FCS of the present invention in the illustrativeembodiment has two operation modes: Normal mode and Direct mode. TheNormal mode is the system default operation mode and provides fullyaugmented flight control capability with flight envelope and structuralprotections. The Direct mode is command by wire, i.e. the pilot directlycommands flight control surface position with stability augmentation andcommand limiting in pitch and yaw axes. A block diagram of thearchitecture of the illustrative fly-by-wire FCS according to thepresent invention is shown in FIG. 5.

With reference to FIG. 5, the illustrative fly-by-wire FCS controlsystem 10 comprises multiple flight control computers FCC1, FCC2 andFCC3, flight control surface controllers including actuator electronicscontrol modules (AECM) 20, 22, 24 and stabilizer motor control units(SMCU) 30 and 32, cockpit controls 50, and aircraft sub-systems whichprovide aircraft input signals 60 and additional data from avionics(e.g. autopilot or navigation systems) 70, aircraft systems 80 and AirData System (ADS)/Inertial Reference System (IRS) 90.

The signals from the various cockpit controls 50 and aircraft inputs 60are received and processed by the AECMs and transmitted to the FCCs viadata bus 100. The signals from the various cockpit controls 50 andselected aircraft inputs 60, in the current embodiment Flap/slatdiscrete data, are received and processed by the SMCUs and transmittedto the FCCs via data bus 100. Other systems e.g., avionics 70, aircraftsystems 80 and ADS/IRS 90, also interface to data bus 100. In thepresent embodiment, the data bus architecture will include an ARINC 429digital communication link, which is standard in the aircraft industry,and each FCC communicates with each AECM and SMCU through a dedicatedARINC 429 data bus; however, other types of data communication linkscould be used. For purposes of illustrative simplicity, a single databus 100 is shown. Other bus configurations can be implemented, such asfor example, using different bus protocols or multiple data buses, aswill be understood by one skilled in the art.

In the illustrative embodiment, triple serial redundant Flight ControlComputers FCC1, FCC2 and FCC3 perform Normal mode control/monitoringfunctions. As will be explained in detail infra, the FCCs each receiveinput from the AECMs and other above mentioned sources, via data bus100, and calculate command signals based on control law algorithmsimplemented in the FCCs. Autopilot system 70 (FIG. 6) can providecomputer control of the aircraft without the need for direct pilot orcopilot input. Upon engagement of the autopilot system 70, the FCCsgenerate the flight surface commands based on signals received from theautopilot system 70 instead of the pilot control signals received fromthe AECMs.

While any single FCC (FCC1, FCC2 or FCC3) is capable of providing fullcontrol functionality in all aircraft axes, the three FCCs operateindependently in an active/standby configuration, with no output commandvoting/comparison between the computers. In this active/standby scheme,while the three FCCs operate in synchronous fashion for failure modeoperation as will be discussed in detail below, only one FCC is activeat any given time: in this embodiment for example, one FCC (FCC1) isdesignated the default active “primary” FCC, and the other 2 FCCs (FCC2and FCC3) each operate independently in a passive “standby” mode toserially come on-line as the “new” primary FCC in the event of failureof the prior active primary FCC (FCC1).

With reference to FIG. 6, the cockpit controls 50 and flight controlsurface controllers AECM and SMCU of FIG. 5 are described in furtherdetail.

Cockpit controls 50 include a pilot and co-pilot sidestick controller51P, 51C, each in a typical implementation of a pistol grip forinputting pitch and roll commands. The sidestick controllers 51P and 51C(through transducers which translate mechanical displacement to anelectrical signal) each generate and provide signals (position or rate)which are coupled to each of the AECMs and SMCUs as shown. Eachsidestick controller has a pitch trim switch 52P and 52C, which arecoupled to each SMCU as shown.

Also included among the cockpit controls 50 are a set of pedals 53P and53C for directional (rudder) control with rudder feel and centering, andrudder trim switch 55 for controlling the rudder trim actuator. Pedals53P and 53C (through transducers which translate mechanical displacementto an electrical signal), and rudder trim switch 55, each generate andprovide signals (position or rate) which are coupled to each of theAECMs as shown.

Cockpit controls 50 include stabilizer cutout switches 57 which provideinput to each of the SMCUs, lateral trim switch 56 for controlling rolltrim. Flight Spoiler Control Lever (FSCL) 54 which provides input toeach of the AECMs and Sidestick Priority Inputs (such as Pilot, Co-PilotStick Priority and glareshield priority switches). The set of pitch trimswitches (52P and 52C) generate appropriate pitch stabilizer trimcommand signal(s) which is/are transmitted to the FCC, via the SMCUs,over data bus 100, while the rudder trim (55) and lateral trim (56)switches generate appropriate rudder and roll stabilizer trim commandsignal(s) which is/are transmitted to the FCC, via the AECMs, over databus 100. Other inputs 60 (as will be detailed in the discussion of FIG.7) are also provided to the AECMs, which include Analog, Discrete andSidestick Priority inputs.

In the discussed embodiment, multiple Actuator Electronic ControlModules (AECM), 20, 22 and 24, perform actuator servo loop closure andthereby control the associated distributed control surfaces (See FIG. 9)in Normal mode, based upon commands from the FCCs as will be discussedin detail. The AECMs also perform Direct mode control and monitoringfunctions as will be described.

In the exemplary embodiment, AECMs 20, 22, 24 are field programmablegate array (FPGA) based and each AECM comprises two hardware dissimilarsubmodules: AECM1 comprises submodules AECM1C and AECM1D; AECM2comprises submodules AECM2C and AECM2D; and AECM3 comprises submodulesAECM3C and AECM3D. By “dissimilar” in this context, is meant that type“C” AECM submodules are built with dissimilar, in this embodiment FPGA,hardware than type “D” AECM submodules. This has the benefit ofincreasing tolerance to generic failures. Although the type C and D AECMsubmodules are FPGA based in the present embodiment, the AECM submodulescould be microprocessor based, or any other type of complex hardwaredevices, or constructed using only analog devices. In addition, theAECMs can be designed to include other than 2 submodules: 1 or more than2, both within the teachings of the invention described herein. Also,the dissimilar hardware in each AECM submodule does not need to be ofthe same hardware type—in other words submodule C can be FPGA whilesubmodule D can be microprocessor based. Such is within the scope of thepresent invention with required changes necessitated by hardware designchoice being understood by those of ordinary skill.

Each submodule AECM1C, AECM1D, AECM2C, AECM2D, AECM3C and AECM3Dconstitutes a control path within the single flight control channel.Flight control surfaces are distributed such that each AECM submoduleand consequently each AECM, operates independently and controls adifferent set of actuators related to each of the three flight controlaxes (pitch, roll and yaw) (see e.g., 21, 23 and 25 in FIG. 9). The twodissimilar submodules per AECM scheme constrains the failure effect of acomplex hardware generic fault and allows for sufficient control forcontinued safe flight and landing in case of generic fault of AECMsubmodule type C or D.

Two Stabilizer Motor Control Units (SMCUs) 30 and 32 are used in theillustrative embodiment to control the horizontal stabilizer trimactuator (HSTA) (see FIG. 9). As they control the HSTA for Normal andDirect mode horizontal stabilizer trim, the SMCUs are of a differentdesign from (and therefore hardware dissimilar to) the AECMs. Similarlyas for the AECMs, whereas each SMCU in the present embodiment isimplemented as a single unit, the SMCUs could be designed to include 2or more internal subunits.

In the illustrative embodiment, the SMCUs also include ananalog-direct-link “ultimate” backup function which providescontrollability of pitch trim, one elevator and one aileron actuatorsper SMCU. The ultimate backup function is not active during Normal orDirect mode operation but is only activated as a contingent last resortredundancy in the event of failure of both Normal and Direct modes, andwill provide short term safe flight capability, e.g., while attemptingto restore the primary flight control system to the Normal/Direct modeafter a temporary drop off of all AECMs.

As used in the foregoing discussion and throughout the description ofthis exemplary embodiment of the present invention, and as will beunderstood from the preceding discussion, the term “flight controlsurface controller” is an abstracted term to convey a mechanism tocontrol the various flight control surfaces of an aircraft. Many typesof flight control surface controllers are known. The flight controlsurface controllers used in the illustrative embodiment of the presentinvention include the AECM and SMCU. In the description herein, the AECMis referred to at a system level as a module and the hardware design ofeach module is such that each module includes submodules. The SMCUs ofthe illustrative embodiment, on the other hand, are implemented assingle units; that is, they are not internally implemented as multiplesubunits in the way the AECMs are internally structured. Such namingconvention has been used for purposes of illustrating functionality andoperability and is not meant in and of itself to limit the architectureof the flight control surface controllers of the present invention. Theredundant parallel functionality of the submodule implementation of theAECMs is one aspect of the invention. For purposes of illustration, inthe example embodiment, the SMCUs are not designed with such internalparallel subunit redundancy, but may be if so desired.

With reference to FIGS. 7 and 8 and the detailed discussion of eachfigure which follows, AECM3 (24) is highlighted for illustration. In theexemplary embodiment described herein, AECM1 and AECM2 are similarlyimplemented.

As can be seen in the illustrative functional block diagram of FIG. 7,AECM3 (24) contains submodules AECM3C (24C) and AECM3D (24D). Each FCC(FCC1, FCC2 and FCC3) comprises command/monitor lanes with dualdissimilar processors (command lane—“A” type and monitor lane—“B” type)as explained in more detail below.

Inputs 700 to AECM3 include: Cockpit Control Inputs 50 (such as FSCL,rudder pedal, sidestick controllers for pilot and co-pilot pitch androll control inputs); Analog & Discrete Inputs 60 (such as Signal forstickshaker pilot cues, OEI (One Engine Inoperative) discrete, Flap/slatdiscrete, Stabilizer position, Rudder trim position, Aileron trimswitch, Yaw rate and Pitch rate sensors (for direct mode operation));and Sidestick Priority Inputs 50 (as outlined above). All these inputs(700) are received through a common backplane 24B and the same inputsare shared between submodules AECM3C and AECM3D.

Since inputs 700 are analog or discrete signals, possible failures ofthese signals and their failure impacts to the system can be easilyanalyzed and verified during the fly-by-wire system design.Dissimilarity is thus not necessary and therefore is not included in theillustrative embodiment. In this way, the two types of AECM submodulesshare the same backplane (24B) and inputs (700) and therefore reduce thecomplexity of the AECM and the fly-by-wire system. However shoulddissimilarity or further isolation be desired, such is nonethelesswithin the scope of the present invention and may be included in systemdesign, for example, through the implementation of two separatebackplanes (one for each AECM submodule) as will be understood by thoseskilled in the art.

Actuation control input electronics block 810C, 810D receive and processinputs 700 and provide sensor excitation. Data concentrator 850C, 850Dcollects input signals from input electronics 810C, 810D and providesthese signals to the FCCs via data bus 100. FCC command block 860C, 860Dreceives command signals generated by the individual FCCs.

In the (although highly improbable) event of a failure of all FCCs, allFCCs are taken off line and the system will revert to operate inAECM/SMCU Direct mode where the pilot will directly control the variousaircraft surfaces. AECM/SMCU Direct mode operation is completelyindependent from FCC software/hardware and is responsive to cockpitcontroller inputs. Similarly, should loss of or insufficient aircraftsensor/system data occur, Normal Mode operation will be lost and thesystem will revert to Direct mode. The illustrative embodiment design issuch as to minimize the possibility of common cause failure that wouldresult in loss of both Normal and Direct modes.

Direct mode control law algorithms are implemented via Direct ModeControl Block 820C, 820D, which receives the input signals from block810C, 810D.

Normal or Direct mode switching is controlled by switching block 830C,830D that, in Normal mode, allows control of the control surfaces to becommanded by the primary FCC. When switched to Direct mode operation,the FCC command path is disengaged such that the pilot can control theaircraft via Direct mode control law paths in the Direct Mode ControlBlock 820C, 820D, as further outlined below.

Servo control electronics 840C, 840D responsive to either primary FCCcommands in Normal mode or direct commands in Direct mode, are used todrive the respective control surfaces in response to calculatedcommands. Power supply 870C, 870D provides, in this case DC, power tothe AECM.

As discussed above, the AECMs receive the cockpit control signals andexecute the flight surface commands generated by the primary FCC inorder to control the movement of the set of flight control surfacesassociated with that AECM. In the illustrative embodiment, as previouslydiscussed, each of the AECMs in the fly-by-wire system areinterchangeable and are each designed to include 2 hardware dissimilarsubmodules so as to effectively constitute 6 AECMs governing 6independent control paths.

With reference to FIG. 8, AECM functionality is discussed in detail,using submodule AECM3D (24D) for illustration. Implementation andoperation of other AECM modules and submodules will be understood to besimilar.

AECM3D has an internal DC power supply 870D that is connected to anindependent power bus—in this case 28v DC bus 3. AECM3D (24D) includes adata bus interface (850D and 860D) that connects AECM3D to each FCCthrough data bus 100. In the present embodiment, AECM3D communicateswith each FCC through an individual data bus, however, multiple commondata buses could be used. AECM3 further includes an internal data bus onbackplane 24B over which data within AECM3 is routed.

The cockpit control signals are applied via backplane 24B to actuationcontrol input electronics block 810D. Input block 810D also receivesanalog and discrete signals as well as sidestick priority inputs (inputs700 discussed above with respect to FIG. 7). Included within actuationcontrol input electronics block 810D is cockpit (pilot/co-pilot) sensorexcitation and demodulation circuitry.

After receiving the cockpit control signals in actuation control inputelectronics block 810D, an analog-to-digital (A/D) converter convertsthe control signals from an analog format to a digital format andtransfers the converted cockpit control signals to the internal data busfor transmission as digital data to the FCCs over data bus 100. Thedigital data is also transmitted to block 820D, which will be used bythe AECM Direct mode control law.

Data concentrator 850D collects all cockpit controller, switch anddiscrete data to supply to all FCCs (FCC1, FCC2 and FCC3).

In the FCCs, the cockpit control signals are combined with data obtainedfrom the various sources discussed with respect to FIGS. 5-7, usingcontrol laws to calculate a set of flight surface commands that will beused by AECM3D to control its assigned set of flight control surfaces.

The calculated flight surface commands are transmitted from the FCCs(FCC1, FCC2 and FCC3) to AECM3D (24D) via data bus 100 where they arereceived by AECM3D through FCC Command Decode Logic block 860D. Block860D also includes a sub block (FCC validity block), which checks forthe FCC validity status and identifies the primary FCC.

Each FCC is comprised of a command lane and a monitor lane withdissimilar processors (type A processor for command lane and type Bprocessor for monitor lane), which compare against one another. In aself-testing regime, a discrepancy outside a predetermined tolerancebetween the command and monitor lanes will result in the affected FCCtaking itself offline and its status being set as invalid, that statusindicated to the AECMs (“FCC invalid”).

The primary FCC will be determined at the FCC level among three FCCs andindicated to the AECMs. Various alternatives of determining a primaryFCC may be implemented, for example, a basic scheme could use prioritylogic such that FCC1 is the designated default primary FCC as long asFCC1 is valid and where FCC 1 is invalid, FCC2 would become primary aslong as FCC2 is valid and so on. Other discrimination schemes may alsobe devised and implemented as will be understood.

Block 860D will receive and check for the FCC validity status (valid orinvalid) and identify the functional primary FCC. Only the functionalprimary FCC commands will be used by AECM3D, however the primary FCCcommands will not be sent through to the actuator servo control block840D unless the primary FCC has been confirmed as valid.

With reference to FIG. 8, actuation control input electronics block 810Dand input actuator servo control block 840D also implement a command andmonitor lane architecture using parallel lanes for fault monitoring.Other fault monitoring schemes may also be devised and implemented aswill be understood by those skilled in the art.

Although not illustrated above, the FCC validity sub block may alsoinclude other means for input signal checks, such as, Cyclic RedundancyCheck (CRC), watchdog timer, etc. Also, the decoded FCC commands byblock 860D could be wrapped back to the FCC for comparison with the FCCoriginal commands to ensure that the correct FCC commands have been usedby the AECM3D.

Normal/Direct Mode Switching Block 830D selectively connects servo loopsthat control the flight control surfaces to receive either the flightsurface commands output from the primary FCC via FCC Command DecodeLogic block 860D, or to receive signals generated from Direct modecontrol law block 820D (which direct mode control laws are illustratedto include Pitch, Lateral and Directional paths).

If the FCC validity block (sub block of 860D) detects that there is novalid FCC available, or no primary FCC available, it will instruct theswitching block 830D to disconnect the FCC commands (block 860D) and toconnect Direct mode control block 820D with the PCU servo controls(block 840D).

Thus, in Normal mode operation, FCC Command Decode Logic block 860Dallows only the commands from the primary FCC, in this case FCC1, topass through to Normal/Direct Mode Switching Block 830D to control theassigned flight control surfaces.

In Direct mode, the associated flight control surfaces are controlleddirectly in response to the cockpit control signals via direct modecontrol law block 820D.

In the illustrative embodiment discussed, in Normal mode, the flightcontrol surface controllers, for example as discussed for AECM3 above,will each receive flight control commands from each of the FCCs (primaryand standby) and FCC Command Decode Logic block 860D will forward onlycommands from the primary FCC to Normal/Direct Mode Switching block830D, and consequently, the flight control surface servo loops aredriven by the commands from the primary FCC. It will be understood bythose skilled in the art that such command/control functionality can be,in alternative embodiments, integrated at other points in the controlpath of the single channel such that, for example, only the designatedprimary FCC transmits its flight commands onto the databus and/or thateach flight control surface controller will only receive one set offlight control commands—i.e., those from the primary FCC. Such differentscheme(s) would impose attendant changes in the illustrative embodimentas will be understood, such as in regards to placement of the FCCCommand Decode Logic block 860D equivalent function where such functionwould be removed from the flight control surface controller and disposedat an appropriate place upstream in the control path. Nonetheless,moving such functionality to other segments of the control path in thesingle channel are considered to be within the scope of the presentinvention and to come under the teachings hereof, as the location ofsuch functionality is not critical to such functionality in the contextof the present invention. Other differences in implementation can alsobe devised where implementation will be accordingly effected.

As outlined above, the AECM submodules in the present embodiment areFPGA based, with the result that the majority of the functions in inputblock 810, control block 820, switching block 830 and control block 840are performed by digital devices. As a result, in the presentembodiment, A/D conversion occurs in input block 810 and D/A conversionoccurs in control block 840. Alternatively, the AECMs could be analogbased devices, in which case the A/D and D/A conversions would occur indata bus interfaces 850 and 860 respectively. Having analog based AECMsallows the design of FBW systems with direct mode operation occurringentirely analogically. The resulting advantage in simplicity androbustness may however be tempered by issues such as reduced flexibilityduring the development phase (in terms of scalability), reduced faultdetection and maintenance capabilities, increased weight and higher lifecycle costs. However, either embodiment is possible pursuant to theinvention, as are others, and all will be deemed to be within the scopeof the invention as described herein.

In either Normal or Direct mode operation, AECM3D controls the movementof a set of distributed flight control surfaces (See FIG. 9) by applyingthe flight control surface commands to the plurality of PCU servocontrol loops, each of which controls a hydraulic actuator connected toone of the flight control surfaces.

Also included among the AECM inputs 700 are pitch and yaw rate sensor(see analog inputs 60, FIG. 7) that provide rate damping input to theelevator or rudder servo loop when the fly-by-wire system is operated inthe Direct mode.

With reference to FIG. 9, the single control channel architecture of thepresent invention controls the pitch, roll and yaw axes through a matrixof distributed control surfaces via multiple control paths.

Although not illustrated, deployment of flight control surfaces aregenerally understood and incorporated on the aircraft main wing and onthe aircraft tail. The control surfaces included on the wings areailerons and multifunction spoilers. The control surfaces included onthe tail section include a rudder, elevators and stabilizer. In theillustrative embodiment of the fly-by-wire flight control system of thepresent invention, the control surfaces are split and/or controlled asfollows. The aileron and elevators are divided into left and right sidesurfaces, each surface powered by two hydraulic actuators: left inboard(LIB) and left outboard (LOB), right inboard (RIB) and right outboard(ROB). The multifunction spoilers (MFS) are divided into left and rightside 1st, 2nd, 3rd and 4th portions, each with a hydraulic actuatordrive. The rudder is a single surface but driven by three hydraulicactuators: upper, middle and lower. The stabilizer is a single wingsurface controlled by two drives (which in the illustrative embodimentare electric motors). The ground spoilers are divided into left andright surfaces, each powered by a single hydraulic actuator. The flightcontrol surfaces (with the exception of the spoilers and rudder) aregenerally positioned by two actuators, each of which is controlled by aseparate path distributed among the AECMs and SMCUs.

In the present embodiment, each AECM submodule in an AECM module ispowered by a separate DC bus (for example, AECM 3D is powered by DC bus3 and AECM 3C is powered by DC bus 2). However, redundant power suppliescould also be used for each AECM submodule such that, for example, bothDC bus 2 and DC bus 3 could supply power to each of AECM 3C and AECM 3D.Because of the higher DC Voltage requirement of the horizontalstabilizer trim actuator (when compared to the other actuators), theSMCUs are each provided AC power by different busses, which is thenconverted to the required DC Voltage by the SMCUs. Furthermore, in analternative embodiment of the present invention, the AC power providedto the SMCUs can also be supplied from air driven generators therebyproviding an extra level of redundancy.

Pitch axis control is effected under the illustrative embodiment of thepresent invention through the use of two elevators and one moveableHorizontal Stabilizer; minimum pitch control (needed for the aircraftcontinued safe flight and landing) can be maintained as long as bothelevators are available, or any one elevator is available combined withthe horizontal stabilizer trim. Roll axis control is effected under theillustrative embodiment of the present invention through two aileronsand four pairs of multifunction spoilers; minimum roll control (neededfor the aircraft continued safe flight and landing) can be maintained byboth ailerons, or by two pairs of MFS, or one aileron plus one pair ofMFS, or any combinations of ailerons and MFS that can provide ⅓ of rollcontrol power. Yaw axis control is effected the illustrative embodimentthrough a single rudder; while the rudder is used as the primary meansfor the aircraft yaw control, yaw axis control can also be achievedthrough the use of differential engine thrust, so that rudder controlloss is not critical to aircraft safety. Such total rudder control losshowever is not likely as any single rudder actuator (of the 3 rudderactuators) can operate the rudder so for there to be total ruddercontrol loss, all three rudder actuators would need to fail at the sametime, which is highly improbable. In addition to their role incontrolling the lateral axis in flight, the multifunction spoilers alsoprovide a speed brake function through the inputs from FSCL and,together with one pair of ground spoilers, provide the ground lift dumpfunction.

In the present invention, the flight control surface actuators aredistributed among the three AECMs/6 AECM submodules and two SMCUs so asto address and accommodate multiple AECM/SMCU failures. Morespecifically, the flight control surface actuators are distributed suchthat one of the AECMs—a “Critical” or “Super” AECM—can safely controlthe aircraft in the event that all remaining AECMs and all SMCUs wouldfail, with the other AECMs—the “Non-Critical AECMs”—being able tocontrol the aircraft in the event that all remaining AECMs and all SMCUsbut one would fail. In the illustrative embodiment, as can be understoodthrough the selection of distributed control surfaces under its control,the Critical AECM is AECM3 and the Non-Critical AECMs are AECM1 andAECM2. As discussed, each AECM consist of two hardware dissimilarsubmodules (C and D), the flight control surface actuators are furtherdistributed such that one set of AECM submodules can safely control theaircraft in the event that the other sets of AECM submodules and allSMCUs would fail. For example, in the illustrative embodiment, shouldall type “C” submodules suffer a generic fault (i.e. AECM1C, AECM2C andAECM3C), the remaining type “D” submodules (i.e. AECM1D, AECM2D andAECM3D) can safely control the aircraft even in the event that all SMCUswould fail.

In the illustrative embodiment of the invention, pitch axis control isachieved through the following flight control surface actuatordistribution. As outlined above, minimum pitch axis control is achievedthrough control of both elevators or through control of one elevator andone horizontal stabilizer trim. With each elevator being controlled by 2elevator actuators (for a total of four), one elevator actuator for eachelevator is allocated to the Critical AECM, with each Non-Critical AECMreceiving one of the remaining two elevator actuators. With respect tothe allocation, within each AECM, the allocation of the elevatoractuators is such that each set of controllers controls one elevatoractuator for each elevator, i.e., each submodule (C and D) controls aleft side and a right side elevator actuator. With the horizontalstabilizer trim being controlled by a single actuator, such actuator isredundantly allocated to each SMCU i.e. each of the motors that powerthe actuator is allocated to an SMCU. Finally, the elevator actuatorsallocated to the Critical AECM have redundant backup allocated to eachSMCU.

In the illustrative embodiment of the present invention, roll axiscontrol is achieved through the following flight control surfaceactuator distribution. As outlined above, minimum roll control isachieved through control of both ailerons, through control of two pairsof MFS or through control of one aileron and one pair of MFS (or throughcontrol of any combinations of ailerons and MFS that can provide ⅓ ofroll control power). With each aileron being controlled by 2 aileronactuators (for a total of four), one aileron actuator for each aileronis allocated to the Critical AECM, with one Non-Critical AECM receivingthe remaining two aileron actuators. With each pair of MFS beingcontrolled by a pair of MFS actuators (for a total of 4 pairs ofactuators), two pairs of MFS actuators are allocated to the Non-CriticalAECM which is not allocated an aileron actuator, with the otherNon-Critical AECM and the Critical AECM each receiving a pair of MFSactuators. Finally, the ailerons actuators allocated to the CriticalAECM have redundant backup allocated to each SMCU.

Finally, in the illustrative embodiment, yaw axis control is achievedthrough the following flight control surface actuator distribution. Asoutlined above, minimum yaw control is achieved through control of thesingle rudder. With the rudder being capable of being operated by anysingle rudder actuator (out of the 3), each such actuator is allocatedto each AECM.

The above flight control surface actuator distribution is complementedwith the hydraulic power and electrical power allocations to ensure thatthe aircraft can be controlled safely in the event of loss of any twohydraulic systems, or loss of any two electrical buses, or loss of anyone hydraulic system combined with any one electrical bus. In theillustrative embodiment, each DC Power source is allocated to 2 of the 6AECM controllers, so that each AECM is powered by a different powersource combination. Each SMCU is powered by a dedicated AC Power source.With respect to hydraulic power systems, each of the three AECM modulesis allocated a different hydraulic power source, with the Critical AECMbeing allocated the hydraulic power source that is the more failuretolerant (in the exemplary embodiment, such hydraulic power source istolerant of double engine failure). Such more failure tolerant hydraulicpower source also is allocated to the SMCUs. For further failuretolerance, the horizontal stabilizer trim actuator is powered not byhydraulic power sources but by electrical motors.

Shown in FIG. 9 are the distributed flight surfaces/actuators of thefly-by-wire FCS of the illustrative embodiment of the present invention,which satisfy all above criteria for actuator distribution.

Shown in the following tables are the flight control surfaces/actuatorscontrolled by a particular AECM controller and SMCU, and the power(hydraulic and electrical) supplied in the illustrative embodiment.

FIG. 9A SMCU1 (30)

Control Unit Actuator Power Power Allocated Surface E-Motor 1 3B (AC)Horizontal Stabilizer Hydraulic System 3 3B (AC) LIB aileron ultimatebackup Hydraulic System 3 3B (AC) LIB Elevator ultimate backup

The LIB aileron ultimate backup and LIB elevator ultimate backup arehydraulic actuated in this embodiment; however, they may also beelectrically actuated.

FIG. 9B SMCU2 (32)

Control Unit Actuator Power Power Allocated Surface E-Motor 2 2B (AC)Horizontal Stabilizer Hydraulic System 3 2B (AC) RIB aileron ultimatebackup Hydraulic System 3 2B (AC) RIB Elevator ultimate backup

The RIB aileron ultimate backup and RIB elevator ultimate backup arehydraulic actuated in the illustrative embodiment; however, they alsocan be electrically actuated.

FIG. 9C AECM1C (AECM1 20)

Control Unit Actuator Power Power Allocated Surface Hydraulic System 1 2(DC) L/R 3 MFS

FIG. 9C AECM1D (AECM1 20)

Control Unit Actuator Power Power Allocated Surface Hydraulic System 1 1(DC) Elevator/LOB actuator Hydraulic System 1 1 (DC) Rudder/UP actuatorHydraulic System 1 1 (DC) L/R 1 MFS

FIG. 9D AECM2C (AECM2 22)

Control Unit Actuator Power Power Allocated Surface Hydraulic System 2 3(DC) Elevator/ROB actuator Hydraulic System 2 3 (DC) Rudder/MID actuatorHydraulic System 2 3 (DC) L/R 4 MFS

FIG. 9D AECM2D (AECM2 22)

Control Unit Actuator Power Power Allocated Surface Hydraulic System 2 1(DC) Aileron/LOB actuator Hydraulic System 2 1 (DC) Aileron/ROB actuatorHydraulic System 2 1 (DC) GRD Spoiler sub-system

FIG. 9E AECM3C (AECM3 24)

Control Unit Actuator Power Power Allocated Surface Hydraulic System 3 2(DC) Elevator/RIB actuator Hydraulic System 3 2 (DC) Rudder/LO actuatorHydraulic System 3 2 (DC) L/R 2 MFS

FIG. 9E AECM3D (AECM3 24)

Control Unit Actuator Power Power Allocated Surface Hydraulic System 3 3(DC) Elevator/LIB actuator Hydraulic System 3 3 (DC) Aileron/RIBactuator Hydraulic System 3 3 (DC) Aileron/LIB actuator

In Normal mode operation, fully augmented flight control as describedabove is achieved through the distributed control surfaces.

In Direct mode, the pilot directly commands control surface position.Stability augmentation and command limiting in pitch and yaw axes areprovided in direct mode (in part via pitch and yaw rate feedback). Aprinciple design criteria in this distribution of power and AECM/SMCUcontrol is to ensure that under even severe failure conditions, airplanecontrollability is maintained at a minimum level such as to allow safeflight. As will be appreciated, the distribution matrix providesfault-isolated, fault tolerant, fail-safe and fail-operationalfunctionality without loss of ability to safely control the aircraft.

The present invention has been illustrated and described with respect tospecific embodiments thereof, which embodiments are merely illustrativeof the principles of the invention and are not intended to be exclusiveor otherwise limiting embodiments. For instance, although thedescription provided hereinabove along with the accompanying drawingsillustrate particular embodiments incorporating one or a few features ofthe present invention, those skilled in the art will understand in viewof the hereinabove disclosure that alternative configurations can bedevised and implemented, as well as other designs capable of achievingthe purpose and benefits of the discussed aspects of the invention.

Accordingly, although the above description of illustrative embodimentsof the present invention, as well as various illustrative modificationsand features thereof, provides many specificities, these enablingdetails should not be construed as limiting the scope of the invention,and it will be readily understood by those persons skilled in the artthat the present invention is susceptible to many modifications,adaptations, variations, omissions, additions, and equivalentimplementations without departing from this scope and withoutdiminishing its attendant advantages. It is further noted that the termsand expressions have been used as terms of description and not terms oflimitation. There is no intention to use the terms or expressions toexclude any equivalents of features shown and described or portionsthereof. It is therefore intended that the present invention is notlimited to the disclosed embodiments but should be defined in accordancewith the claims that follow.

What is claimed is:
 1. A fly-by-wire flight control system of anaircraft, the system comprising: a plurality of input controls, each oneof the plurality of input controls being capable of generating a signalindicative of a commanded position of at least one flight controlsurface; a plurality of flight control computers, each one of theplurality of flight control computers being capable of generating flightsurface control commands according to predetermined flight controlalgorithms in part as a function of the signal, wherein at least one ofthe plurality of flight control computers is capable of determining thatit is invalid based on a self-testing regime; and a plurality of flightcontrol surface controllers, each one of the plurality of flight controlsurface controllers being capable of controlling the at least one flightcontrol surface based on at least one of (i) the flight surface controlcommands generated by at least one of the plurality of flight controlcomputers and (ii) the signal.
 2. The fly-by-wire flight control systemof claim 1, wherein at least another one of the plurality of flightcontrol computers is capable of becoming an active primary flightcontrol computer upon determination by the at least one of the pluralityof flight control computers that it is invalid.
 3. The fly-by-wireflight control system of claim 1, wherein at least one of the pluralityof flight control surface controllers, upon determining that none of theplurality of flight control computers is capable of becoming an activeprimary flight control computer, is capable of being commanded accordingto predetermined flight control algorithms for direct mode operation inresponse to the signal.
 4. The fly-by-wire flight control system ofclaim 1, wherein the at least one of the plurality of flight controlcomputers comprises a command lane and a monitor lane capable ofcomparing against one another.
 5. The fly-by-wire flight control systemof claim 4, wherein the self-testing is configured so that a discrepancyoutside a predetermined tolerance between the command lane and themonitor lane results in the at least one of the plurality of flightcontrol computers setting its status as invalid.
 6. The fly-by-wireflight control system of claim 4, wherein the self-testing is configuredso that a discrepancy outside a predetermined tolerance between thecommand lane and the monitor lane results in the at least one of theplurality of flight control computers taking itself offline.
 7. Thefly-by-wire flight control system of claim 5, wherein at least one ofthe plurality of flight control surface controllers is being indicatedthat the status of the at least one of the plurality of flight controlcomputers is invalid.
 8. The fly-by-wire flight control system of claim4, wherein the command lane and the monitor lane have dissimilarprocessors.
 9. The fly-by-wire flight control system of claim 2, whereinthe at least another one of the plurality of flight control computers iscapable of becoming the active primary flight control computer based on(i) a determination by the at least one of the plurality of flightcontrol computers that it is invalid and (ii) a priority logic.
 10. Thefly-by-wire flight control system of claim 1, further comprising avalidity block configured to detect whether no valid flight controlcomputer amongst the plurality of flight control computers is availableand further configured to instruct a switching block to disconnectflight surface control commands and to connect direct mode control. 11.A flight control computer for an aircraft, the flight control computercomprising: a receiving module for receiving a signal indicative of acommanded position of at least one flight control surface of theaircraft, the signal being generated by at least one input control; afirst processor configured to execute a command lane, the command lanegenerating flight surface control commands according to predeterminedflight control algorithms in part as a function of the signal; a secondprocessor configured to execute a monitor lane; and a self-testingmodule configured to compare the command lane against the monitor laneto identify whether the flight control computer is to operate at leastone of (i) taking itself offline and (ii) setting its status as invalid.12. The flight control computer of claim 11, wherein the self-testingmodule is configured so as to determine whether a difference between thecommand lane and the monitor lane is within a predetermined tolerance.13. The flight control computer of claim 11, further comprising a moduleconfigured to determine that the flight control computer is to become anactive primary flight control computer upon determination that anotherflight control computer is invalid.
 14. A flight surface controller foran aircraft, the flight surface controller comprising: a receivingmodule for receiving at least one of flight surface control commands anda signal, the flight surface control commands being generated by aflight control computer and the signal being generated by an inputcontrol; a control module being capable of controlling at least oneflight control surface of the aircraft based on at least one of theflight surface control commands and the signal; and a command decodelogic module capable of determining that no flight control computer isbeing capable of becoming an active primary flight control computer ofthe aircraft.
 15. The flight surface controller of claim 14, wherein thecontrol module is capable of being commanded according to predeterminedflight control algorithms for direct mode operation in response to thesignal upon determination, by the command decode logic module, that noflight control computer is being capable of becoming an active primaryflight control computer of the aircraft.
 16. A method of controlling anaircraft, the method comprising: receiving a signal indicative of acommanded position of at least one flight control surface of theaircraft; generating, by a first flight control computer, flight surfacecontrol commands according to predetermined flight control algorithms inpart as a function of the signal; upon determining that the first flightcontrol computer is invalid, selecting a second flight control computerto become an active primary flight control computer; generating, by thesecond flight control computer, flight surface control commandsaccording to predetermined flight control algorithms in part as afunction of the signal; and applying the flight surface control commandsto a flight control surface controller, the flight control surfacecontroller being capable of controlling at least one flight controlsurface of the aircraft.
 17. The method of claim 16, further comprising:determining that none of the first flight control computer and thesecond flight control computer is capable of becoming the active primaryflight control computer; and commanding the flight control surfacecontroller according to predetermined flight control algorithms fordirect mode operation in response to the signal.
 18. The method of claim16, wherein determining that the first flight control computer isinvalid is executed by a self-testing module of the first flight controlcomputer.
 19. The method of claim 16, wherein the method comprises, upondetermining that the first flight control computer is invalid, at leastone of (i) taking the first flight control computer offline and (ii)setting the status of the first flight control computer as invalid. 20.A fly-by-wire flight control system of an aircraft, comprising: aplurality of input controls, each one of the plurality of input controlsbeing capable of generating a signal indicative of a commanded positionof at least one flight control surface; a plurality of flight controlcomputers, wherein a first one of the plurality of flight controlcomputers is an active flight control computer capable of generatingflight surface control commands according to predetermined flightcontrol algorithms in part as a function of the signal; and wherein thefirst one of the plurality of flight control computers is capable ofdetermining that it is invalid, and a second one of the plurality offlight control computers is capable of becoming the active flightcontrol computer.